A Measurement Driven Anti-Jamming System for Networks

Transcription

1 A Measurement Driven Anti-Jamming System for Networks 1 Konstantinos Pelechrinis, Ioannis Broustis, Srikanth V. Krishnamurthy, Christos Gkantsidis University of Pittsburgh University of California, Riverside Microsoft Research, Cambridge, UK kpele@pitt.edu { broustis, krish}@cs.ucr.edu chrisgk@microsoft.com Abstract Dense, unmanaged deployments tempt saboteurs into launching jamming attacks by injecting malicious interference. Nowadays, jammers can be portable devices that transmit intermittently at low power in order to conserve energy. In this paper, we first conduct extensive experiments on an indoor network to assess the ability of two physical layer functions, rate adaptation and power control, in mitigating jamming. In the presence of a jammer we find that: (a) the use of popular rate adaptation algorithms can significantly degrade network performance and, (b) appropriate tuning of the carrier sensing threshold allows a transmitter to send packets even when being jammed and enables a receiver capture the desired signal. Based on our findings, we build ARES, an Anti-jamming REinforcement System, which tunes the parameters of rate adaptation and power control to improve the performance in the presence of jammers. ARES ensures that operations under benign conditions are unaffected. To demonstrate the effectiveness and generality of ARES, we evaluate it in three wireless testbeds: (a) an 82.11n WLAN with MIMO nodes, (b) an 82.11a/g mesh network with mobile jammers and (c) an 82.11a WLAN with TCP traffic. We observe that ARES improves the network throughput across all testbeds by up to 1%. Categories and Subject Descriptors: C.2. [General]: Security and Protection C.2.3 [Computer - Communication Networks]: Network Operations. General Terms: Design, Experimentation, Measurement, Performance, Security Keywords: IEEE 82.11, Rate Control, Power Control, Jamming I. INTRODUCTION The widespread proliferation of wireless networks makes them an attractive target for saboteurs with jamming devices [1], [2], [3], [4]; this makes the defense against such attacks very critical. A jammer transmits electromagnetic energy to hinder legitimate communications on the wireless medium. A jamming attack can cause the following effects in an network: (a) Due to carrier sensing, co-channel transmitters defer their packet transmissions for prolonged periods. (b) The jamming signal collides with legitimate packets at receivers. Frequency hopping techniques have been previously proposed for avoiding jammers [] [6]. Such schemes however, are not effective in scenarios with wide-band jammers [7], [8]. Furthermore, given that operates on relatively few frequency channels, multiple jamming devices operating on different channels can significantly hurt performance in spite of using frequency hopping [9]. In this paper, we ask the question: How can legacy devices alleviate the effects of a jammer that resides on the same channel used by a legitimate communicating pair, in real time? We address this challenge by developing ARES, 1 a novel measurement driven system, which detects the presence of jammers and invokes rate adaptation and power control strategies to alleviate jamming effects. Clearly, not much can be done to mitigate jammers with unlimited resources in terms of transmission power and spectrum efficiency. Note however that in a plurality of cases the jamming device can be resource constrained, with capabilities similar to that of the legitimate device. 2 Portable, battery-operated jammers are typically configured to transmit intermittently and sometimes at low power, in order to conserve energy and harm the network for extended periods of time. In addition, misconfiguration of legitimate devices can transform them to resource-constrained jammers [3]. In such cases, ARES can effectively fight against the malicious entity, as we discuss later. Our contributions are the following: 1. Understanding the impact of jammers in an network with rate/power control. First, we perform an indepth measurement-based experimental study on our indoor testbed, to quantify the impact of jamming when employing rate and/or power control. To the best of our knowledge, there are no such studies to date. With rate control, a transmitter can increase or lower its transmission rate depending on the observed packet delivery ratio (PDR) at the receiver. With power control, nodes may increase their transmission powers and/or clear channel assessment (CCA) thresholds [1] in order to increase the probability of successful packet reception. The design of ARES is driven by two key experimental observations: i) Rate adaptation can be counter-productive: In the presence of a jammer that is active intermittently (and sleeps in between), the use of rate adaptation is not always beneficial. We conduct experiments with three popular rate adaptation algorithms: SampleRate [11], Onoe [12] and AMRR (Adaptive Multi Rate Retry) [13]. With every scheme, we observe that the use of rate adaptation may work in favor of the jammer. This 1 ARES [pron. áris ] was the god of war in Greek mythology; we choose the name as a symbol of the combat with jammers. 2 We implement a jamming utility on a commodity NIC as described in more detail in Section III.

2 is because, rate adaptation wastes a large portion of a jammer s sleeping time in order to gradually converge to the best rate. We analytically determine when fixed rate operations may be preferable to the use of rate adaptation. ii) Tuning the carrier sense threshold is beneficial: We collect throughput measurements with many different transmission powers and CCA thresholds. We find that: (a) In the presence of a jammer, legitimate transmissions with maximum power could lead to significant benefits, only when operating at low data rates. (b) Increasing the CCA threshold can allow a transmitter that is being jammed to send packets and in addition, facilitate the capture of packets in the presence of jamming interference; together, these effects can significantly reduce the throughput degradation. 2. Designing ARES, a novel anti-jamming system. The above observations drive the design of ARES. ARES primarily consists of two modules. The rate control module chooses between fixed-rate assignment and rate adaptation, based on channel conditions and the jammer characteristics. The primary objective of this module is to effectively utilize the periods when a jammer is asleep. The power control module adjusts the CCA threshold to facilitate the transmission and the reception (capture) of legitimate packets during jamming. Care is taken to avoid starvation of nodes due to the creation of asymmetric links [1]. This module is used to facilitate successful communications while the jammer is active. Although rate and power control have been proposed as interference alleviation techniques, their behavior has not been studied in jamming environments. To our knowledge, our work is the first to conduct such a study. 3. Implementing and experimentally validating ARES. We implement and evaluate the modules of ARES on real hardware, thereby making ARES one of the few anti-jamming system implementations for networks. ARES relies on the existence of an accurate jamming detection module. It is beyond the scope of our work to design a new detection scheme, and thus we incorporate a mechanism proposed previously in [14]. To demonstrate the effectiveness and generality of our system, we apply it on three different experimental networks: an 82.11n WLAN with MIMO enabled nodes, an 82.11a/g mesh network with mobile jammers, and a static 82.11a WLAN with uplink TCP traffic. Our measurements demonstrate that ARES provides performance benefits in all the three networks; throughput improvements of up to 1% are observed. The remainder of the paper is structured as follows. In section II, we provide some background on jamming and discuss related studies. In section III, we describe our wireless testbed and the experimental methodology. We describe our extensive experiments to understand the impact of rate and power control in the presence of a jammer in sections IV and V respectively. In section VI, we construct ARES based on our observations. We present our evaluations of ARES in section VII. Section VIII discusses the scope of our study. We conclude in section IX. II. BACKGROUND AND RELATED WORK In this section, first we briefly describe the operations of a jammer and its attack capabilities. Next, we discuss relevant previous studies. Types of Jamming Attacks. Jammers can be distinguished in terms of their attack strategy; a detailed discussion can be found in [14]. Non-stop jamming: Constant jammers continuously emit electromagnetic energy on a channel. Nowadays, constant jammers are commercially available and easy to obtain [1], [7]. While constant jammers emit non-decipherable messages, deceptive jammers transmit seemingly legitimate back-to-back dummy data packets. Hence, they can mislead other nodes and monitoring systems into believing that legitimate traffic is being sent. Intermittent Jamming: As the name suggests, these jammers are active intermittently; the primary goal is to conserve battery life. A random jammer typically alternates between uniformlydistributed jamming and sleeping periods; it jams for T j seconds and then it sleeps for T s seconds. A reactive jammer starts emitting energy only if it detects traffic on the medium. This makes the jammer difficult to detect. However, implementing reactive jammers can be a challenge. For the purposes of this work, we primarily consider the deceptive-random jammer model. Attackers are motivated into using a random jammer because putting the jammer to sleep intermittently can increase its lifetime and decrease the probability of detection [14]. Furthermore, it is the most generalized representation of a jammer; appropriately choosing the sleep times could turn the jammer into a constant jammer or (with high probability) a reactive jammer. Moreover, reactive jammers are not easily available since they are harder to implement and require special expertise on the part of the attacker. Nevertheless, we show the applicability of ARES with constant and reactive jammers, in section VIII. Related work. Most previous studies employ frequency hopping to avoid jammers. Frequency hopping, however, cannot alleviate the influence of a wide-band jammer [7], [8], which can effectively jam all the available channels. In addition, recent studies have shown that a few cleverly-coordinated, narrowband jammers can practically block the whole spectrum [9]. Thus, ARES does not rely on frequency hopping. Studies based on frequency hopping: Navda et al. [] implement a proactive frequency hopping protocol with pseudorandom channel switching. They compute the optimal frequency hopping parameters, assuming that the jammer is aware of the procedure followed. Xu et al. [6] propose two antijamming techniques: reactive channel surfing and spatial retreats. However, their work is on sensor networks which only support very low data rates and transmission powers. Gummadi et al. [1] find that devices are vulnerable to specific patterns of narrow-band interference related to time recovery, dynamic range selection and PLCP-header processing. They show that due to these limitations, an intelligent jammer with a 1 times weaker signal (than that of the legitimate

3 transceiver) can still corrupt the reception of packets. In order to alleviate these effects, they propose a rapid frequency hopping strategy. Other relevant work: Xu et al. [14] develop efficient mechanisms for jammer detection at the PHY layer (for all the 4 types of jammers). However, they do not propose any jamming mitigation mechanisms. In [16], the same authors suggest that competition strategies, where transceivers adjust their transmission powers and/or error correction codes, might alleviate jamming effects. However, they neither propose an anti-jamming protocol nor perform evaluations to validate their suggestions. Lin and Noubir [17] present an analytical evaluation of the use of cryptographic interleavers with different coding schemes to improve the robustness of wireless LANs. In [18], the authors show that in the absence of error-correction codes (as with 82.11) the jammer can conserve battery power by destroying only a portion of a legitimate packet. Noubir [19] also proposes the use of a combination of directional antennae and node-mobility in order to alleviate jammers. ARES can easily be used in conjunction with directional antennas or with error correction codes. We would like to refer the interested reader to our literature survey on anti-jamming systems in [2] for more details. Prior work on rate and power control: Rate and power control techniques have been proposed in the literature, as means of mitigating interference (e.g. [21], [11], [1], [22], [23] and the references therein). However, they do not account for a hostile jamming environment; with these schemes, nodes cooperate in order to mitigate the impact of legitimate interference, thereby improving the performance. As an example, Zhai and Fang [23] consider the optimal carrier sensing range for maximum spatial reuse in MANETs. All nodes are restricted to the same maximum transmission power and their work is purely based on analysis and simulations. In this study we follow a purely experimental approach and our results indicate that ARES effectively alleviates the impact of jammers that use higher transmission powers. Our scheme is specialized towards handling malicious interference of jammers, which attempt to disrupt ongoing communications. III. EXPERIMENTAL SETUP In this section, we describe our wireless testbed and the experimental methodology that we follow. Testbed Description: Our wireless testbed [24] is deployed in the third floor of Engineering Building II, at the University of California, Riverside. Our testbed consists of 37 Soekris net4826 nodes [2], which mount a Debian Linux distribution with kernel v2.6, over NFS. The node layout is depicted in Figure 1. Thirty of these nodes are each equipped with two minipci 82.11a/g WiFi cards, an EMP-862 6G with Atheros chipset and an Intel-291. The other 7 nodes are equipped with one EMP-862 6G and one RT286 card that supports MIMObased (82.11n) communications. We use the MadWifi driver [26] for the EMP-862 6G cards. We have modified the Linux client driver [27] of the RT286 to enable STBC (Space Time Fig. 1. The deployment of our wireless testbed. Block Coding) support. We use a proprietary version of the ipw22 AP (access point) and client driver/firmware of the Intel-291 card. With this version we are able to tune the CCA threshold parameter. Experimental Settings and Methodology: We experiment with different rate adaptation algorithms in the presence of random jammers. We also perform experiments with various transmission powers of jammers and powers/cca thresholds of legitimate nodes. Our measurements encompass an exhaustive set of wireless links, routes of different lengths, as well as static and mobile jammers. We examine both SISO and MIMO links. We experiment with three modes of operation: 82.11a/g/n (unless otherwise stated throughout this paper, our observations are consistent for all three modes of operation). The experiments are performed late at night in order to isolate the impact of the jammers by avoiding interference from co-located WLANs. By default, all devices (legitimate nodes and jammers) set their transmission powers to 18 dbm (for our experiments that involve only the Intel-291 cards, the maximum power that we can use is 2dBm). Implementing a random jammer: Our implementation of a random jammer is based on a specific configuration (CCA = dbm) and a user space utility that sends broadcast packets as fast as possible. For the purposes of research, we have implemented our own random jammer on an legacy device, by setting the CCA threshold to dbm. By setting the CCA threshold to such a high value, we force the device to ignore all legitimate signals even after carrier sensing; packets arrive at the jammer s circuitry with powers less than dbm (even if the distances between the jammer and the legitimate transceivers are very small). An effective random jammer should be able to transmit packets on the medium, as fast as possible, during random active time intervals. We develop a user-space software utility with the following functionalities: The jammer transmits broadcast UDP traffic. This ensures that its packets are transmitted back-to-back and that the jammer does not wait for any ACK messages (by default the backoff functionality is disabled in for broadcast traffic); in other words, this set up allows the

4 jamming node to defer its back-to-back transmissions for the minimum possible time (i.e. DIFS + min BackOff ). Our utility employs raw sockets, which allow the construction of UDP packets from scratch and the forwarding of each packet directly down to the hardware. Note that this implementation bypasses the protocol and hence, the jammer does not wait in the backoff state after each packet transmission. Our utility schedules uniformly-distributed random jamming intervals. The jammer is in the active state for a random period of time, during which it constantly transmits packets back-to-back. It then transits to an idle (sleeping) state for a different, randomly chosen period of time during which it does not emit energy. The two states alternate and their durations are computed anew at the beginning of each cycle (a cycle consists of an active and an idle period). We use a set of 4 nodes as jammers on our testbed; these are equipped with Intel-291 cards which allow CCA tuning. Traffic characteristics: We utilize the iperf measurement tool to generate UDP data traffic among legitimate nodes; the packet size is 1 bytes. The duration of each experiment is 1 hour. For each experiment, we first enable iperf traffic between legitimate nodes, and subsequently, we activate the jammer(s). We consider both mesh and WLAN connectivity. We experiment with different jammer distributions, namely: (a) frequent jammers, which are active almost all of the time, (b) rare jammers, which spend most of their time sleeping, and (c) balanced jammers that have similar average jamming and sleeping times. We have disabled RTS/CTS message exchange throughout our experiments (a common design decision in practice [28]). IV. SYSTEM GUIDELINES FOR RATE ADAPTATION Rate adaptation algorithms are utilized to select an appropriate transmission rate as per the current channel conditions. As interference levels increase, lower data rates are dynamically chosen. Since legitimate nodes consider jammers as interferers, rate adaptation will reduce the transmission rate on legitimate links while jammers are active. Hence, one could potentially argue that rate control on legitimate links increases reliability by reducing rate and thus, can provide throughput benefits in jamming environments. To examine the validity of this argument, we experiment with three different, popular rate adaptation algorithms, SampleRate [11], AMRR [13] and Onoe [12]. These algorithms are already implemented on the MadWifi driver that we use. For simplicity, we first consider a balanced random jammer, which selects the sleep duration from a uniform distribution U[1, 8] and the jamming duration from U[1, ] (in seconds). Details on the experimental process: We perform experiments with both single-hop and multi-hop configurations. In each experiment, we first load the particular rate-control Linuxkernel module (SampleRate, AMRR or Onoe) on the wireless cards of legitimate nodes. We initiate data traffic between the nodes and activate the jammer after a random time. We collect throughput measurements on each data link once every msec. We use the following terminology: 1) Fixed transmission rate R f : This is the nominal transmission rate configured on the wireless card. 2) Saturated rate R s : It is the rate achieved when R f is chosen to be the rate on the wireless card. In order to compute R s, for a given R f, we consider links where the packet delivery ratio (PDR) is 1 % for the particular setting of R f ; we then measure the rate achieved in practice. We notice that for lower values of R f, the specified rate is actually achieved on such links. However, for higher values of R f (as an example R f = 4 Mbps), the achieved data rate is much lower; this has been observed in other work e.g. [29]. Table I contains a mapping, derived from measurements on our testbed, between R f and R s. 3) Application data rate R a : This is the rate at which the application generates data. R f R s TABLE I THE SATURATED-THROUGHPUT MATRIX IN MBPS. It is difficult (if not impossible) to a priori determine the best fixed rate on a link. Given this, and if we let R be the set of all possible fixed transmission rates, we set: R f = {min x R x : x R a }, which is the maximum rate that is required by the application (we discuss the implications of this choice later). Our key observations are summarized below: Rate adaptation algorithms perform poorly on highquality links due to the long times that they incur for converging to the appropriate high rate. On lossless links, the fixed rate R f is better, while rate adaptation is beneficial on lossy links. We defer defining what constitute lossless or lossy links later in this section; conceptually, we consider lossless links to be those links that can achieve higher long-term throughput using a fixed transmission rate R f, rather than by applying rate adaptation. 1) Single-hop Configurations: Our experiments with onehop connectivity involve 8 sets of sender-receiver pairs and one jammer per pair. We impose that a jammer interferes with one link at a time and that the legitimate data links do not interfere with each other. Thus, we perform 2 different sets of experiments, with 4 isolated data links and 4 jammers in each experiment. Rate adaptation consumes a significant part of the jammer s sleep time, to converge to the appropriate rate: As soon as the jammer goes to sleep, the link quality improves and thus, the rate control algorithm starts increasing the rate progressively. However, since the purpose of a jamming attack is to corrupt as many transmissions as possible, the jammer will typically not sleep for a long time. In such a case, the sleep duration of the jammer will not be enough for the rate control

5 to reach the highest rate possible. To illustrate this we choose two links on our testbed, one that can support 12 Mbps and the other that can support 4 Mbps. Figure 2 depicts the results. We observe that (a) irrespective of whether SampleRate or a fixed rate strategy is used, during jamming the throughput drops to values close to zero since the jammer blocks the medium for the sender, and (b) the throughput achieved with SampleRate is quite low, and much lower than if we fix the rate to the constant value of 12 Mbps. Note that we have observed the same behavior with AMRR and Onoe. Fixed rate assignment outperforms rate adaptation on lossless links: As alluded to above, in order to find the best rate on a link after a period where there is no throughput due to a jammer, the rate adaptation mechanisms gradually increase the rate, invoking transmissions at all the lower rates interim, until the best rate is reached. For links that can inherently support high rates, this process might consume the sleep period of the jammer (as suggested by the results in Figure 2). If the best rate for a link was known a priori, at the instance that the jammer goes to sleep, transmissions may be invoked at that rate. This would utilize the sleep period of the jammer more effectively. As observed in Figure 3, the throughputs achieved with fixed rate assignment are much higher than those achieved with rate adaptation on such links. Determining the right transmission rate policy: Implications of setting R f = {min x R x : x R a }: Since the application does not require the link to sustain a higher rate, the highest throughput for that application rate is reached either with this choice of R f or with some rate that is lower than R a. If the rate adaptation algorithm converges to a rate that results in a throughput that is higher than with the chosen R f, then the adaptive rate strategy should be used. If instead, during the jammer s sleep period, the rate adaptation technique is unable to converge to such a rate, the fixed rate strategy is better. Analytically determining the right rate: In order to determine whether it is better to use a fixed or an adaptive-rate approach for a given link, we perform an analysis based on the following parameters: 1) The distribution of the jammer s active and sleep periods (we call this the jammer s distribution). 2) The application data rate, R a. 3) The performance metric on the considered legitimate link, i.e., PDR, link throughput, etc. 4) The rate adaptation scheme that is employed, i.e., Onoe, SampleRate, etc. The key scheme-specific factor is the transition time from a lower rate to the next higher rate, under conducive conditions. ) The effectiveness of the jammer F, measured by the achievable throughput while the jammer is on. The lower the throughput, the more effective the jammer. Let us suppose that the expected sleeping duration of the jammer during a cycle, is given by E[t s ] and the expected period for which it is active, by E[t j ]. The expected duration of a cycle is then E[t s ] + E[t j ]. As an example, if the jammer picks its sleeping period from a uniform distribution U[a, b] and its jamming period from U[c, d], E[t s ] and E[t j ] are equal to b+a 2 and d+c 2, respectively. For simplicity let us assume that the link-quality metric employed 3 is the PDR. With application data rate R a and fixed transmission rate R f, the throughput achieved during a jammer s cycle is: T fixed = E[t s ] E[t s ] + E[t j ] PDR E[t j ] f R s + F, (1) E[t s ] + E[t j ] where PDR f is the PDR of the link at rate R f. Recall that the rate achieved in practice with a specified rate R f is R s. To compute the throughput with rate adaptation, we proceed as follows. Let us assume that x(f, R s ) corresponds to the convergence time of the rate adaptation algorithm (specific to the chosen algorithm). We consider the following two cases. 1) x(f, R s ) < E[t s ]. This case holds when the jammer s sleep duration is sufficient (on average) for the rate control algorithm to converge to the best rate R s. In this scenario, the achievable throughput is: T adapt = [E[t s ] x(r s )] R s + R i y(r i ) R i + E[t j ] F E[t s ] + E[t j ] where R i S, S being the set of all intermediate rates from F to R s. y(r i ) is the time that the rate control algorithm spends at the corresponding rate R i. The values of y(r i ) are specific to the implementation of the rate control algorithm. Note that x(f, R s ) can be easily computed from y(r i ) by adding all the individual durations for the rates belonging to the set S. 2) x(f, R s ) E[t s ]. In this scenario, the average sleep time of the jammer is insufficient for the rate control algorithm to converge to the desired rate. When the jammer wakes up, the rate will again drop due to increased interference. Here, the throughput that can be achieved during a jammer s cycle is: [ ] n n y(r i ) R i + E[t s ] y(r i ) R n+1 + E[t j ] F T adapt = i=1 where n = max{k : i=1 E[t s ] + E[t j ] k y(r i ) E[t s ] }. i=1 Based on the above analysis, we define a link to be lossy, when T fixed T adapt ; the links on which T fixed > T adapt are classified as lossless links. Clearly for lossy links it is better to use the rate adaptation algorithm. The analysis can be used to compute PDRf TH, a threshold value of PDR f below which, a rate adaptation strategy performs better than the fixed rate approach. In particular, by setting T fixed = T adapt and solving this equation, one can compute PDRf TH. Based on this, a decision can be made on whether to enable rate adaptation or use fixed-rate assignment. If the observed PDR is larger than 3 Our analysis can be modified to adopt any other link-quality metric.,

6 Throughput (Mbps) Fixed rate 12Mbps Sample rate 12Mbps Throughput (Mbps) Fixed rate 4Mbps Sample rate 4Mbps Average Throughput (Mbps) Fixed Rate Sample Rate AMRR ONOE Time (sec) Time (sec) Fig. 2. Rate adaptation algorithms may not find the best rate during the sleep period of the jammer. We show cases for R a = 12 Mbps (left) and R a = 4 Mbps (right) Rate(Mbps) Fig. 3. Fixed rates outperform rate adaptation for highquality links, under random jamming. (R a = R f ) the computed threshold, fixed rate should be used; otherwise, rate adaptation should be used. 4 Validation of our analysis: In order to validate our analysis, we measure PDRf TH on 8 different links in the presence of a balanced jammer. We then compare them against the PDRf TH values computed with our analysis. Note here that the analysis itself depends on measured values of certain quantities (such as the jammer distribution and the function y(r i )). In this experiment, we consider the SampleRate algorithm, and measure the values of x(f, R s ) and y(r i ). The jammer s sleep time follows U[, 4] and the jamming time follows U[1, 6]. Figure 4 plots the values of function y for different values of R f. In Table II, we compare the theoretically computed PDR thresholds with the ones measured on our testbed, for various values of R f. We observe that the PDR f thresholds computed with our analysis are very similar to the ones measured on our testbed. There are slight discrepancies since our analysis is based on using measured average values which may change to some extent over time. We wish to stress that while we verify our analysis assuming that the jammer is active and idle for uniformly distributed periods of time, our analysis depends only on expected values and is therefore valid for other jammer distributions. Finally, Figure shows the advantage of using a fixed rate approach over SampleRate for various PDR values and with R f = 4 Mbps. We observe that SampleRate provides higher throughput only for very low PDR values. R f Measured PDR TH f Analytical PDR TH f TABLE II PDR f THRESHOLDS Next, we consider two extreme cases of jamming: frequent 4 Note here that if the jammer temporally varies the jamming and timing cycles, our analysis is still valid but for shorter time scales (cycles over which these distributions are stationary). and rare jammers (see section III). The distributions that we use in our experiments for these jammers are shown in Table III. Note that by choosing the jammer s sleeping and jamming time from distributions like that of the frequent jammer, we essentially construct a constant jammer. With frequent jammers, the difference in the performance between fixed rate assignment and rate adaptation is larger, while for a rare jammer it is smaller. This is because with rare jamming, rate adaptation has more time to converge and therefore often succeeds in achieving the highest rate possible; one observes the opposite effect when we have a frequent jammer. The results are plotted in Figures 6 and 7. - Sleep time (sec) Jamming time (sec) Balanced U[1,8] U[1,] Rare U[1,] U[1,2] Frequent U[1,2] U[1,1] TABLE III THE JAMMING DISTRIBUTIONS THAT WE USE IN OUR EXPERIMENTS. 2) Random Jamming in Multi-hop Topologies: Next, we examine the impact of a random jammer on the end-toend throughput of a multi-hop path. We experiment with 1 different routes on our testbed. We fix static routes of various lengths (from 2 to 4 links per route) utilizing the route Unix tool in order to modify the routing tables of nodes. We place a jammer such that it affects one or more links. Along each route, links that are not affected by the jammer consistently use a rate adaptation algorithm. On the links that are subject to jamming, our analysis dictates the decision on whether to use fixed or adaptive rate assignment. We measure the end-toend throughput on the route. We show our results for routes on which, in the absence of a jammer, end-to-end throughput of 6 and 12 Mbps was observed. From Figure 8 we see that the throughput trend with rate adaptation on multi-hop routes in the presence of a random jammer, is the same as that on a singlehop link. In particular, with low data rates a sufficiently high PDR has to be sustained over the links that constitute the route in order for a fixed rate approach to perform better than rate adaptation. On the other hand, when routes support high data rates, fixing the rate on the individual links (that are affected by the jammer) as per our analytical framework, provides higher benefits.

7 Rate Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 4Mbps Time(sec) Fig. 4. Measured convergence times of the MadWifi SampleRate algorithm, for the different application data rates. Throughput gain (Mbps) PDR Fig.. Throughput gain of fixed rate Vs. SampleRate, for various link qualities and for application data rate of 4 Mbps. Average Throughput (Mbps) Fixed Rate Sample Rate Rate(Mbps) Fig. 6. The performance with rare jammers is aligned with our observations for the case with balanced jammers. (R a = R f ) Average Throughput (Mbps) Fixed Rate Sample Rate Rate(Mbps) Fig. 7. Fixed rate improves the performance more than rate adaptation at high rates, with frequent jammers. (R a = R f ) Average Throughput (Mbps) Fixed Rate Sample Rate 6 Rate(Mbps) Fig. 8. Rate adaptation presents the same behavior in multihop links; it provides lower throughput at high rates. 12 P L (dbm) P (dbm) J Fig. 9. Percentage of the isolated throughput, for various P L and P J combinations, and for R f = R a = 6Mbps Choosing the right policy in practice: To summarize our findings, our analysis demonstrates that using a fixed rate may be attractive on lossless links while it would be better to use rate adaptation on lossy links. However, as discussed, determining when to use one over the other in real time during system operations is difficult; the determination requires the knowledge of x(f, R s ), y(r i ) and estimates of how often the jammer is active/asleep, on average. Thus, we choose a simpler practical approach that we call MRC for Markovian Rate Control. We will describe MRC in detail later (in section VI) but in a nutshell, MRC induces memory into the system and keeps track of the feasible rates during benign jamming-free periods; as soon as the jammer goes to sleep, legitimate transmissions are invoked at the most recent rate used during the previous sleeping cycle of the jammer. We also perform offline measurements by directly using our analytical formulation (with knowledge of the aforementioned parameters); these measurements serve as benchmarks for evaluating the efficacy of MRC (discussed in section VII). V. SYSTEM GUIDELINES FOR POWER CONTROL Next, we examine whether tuning power levels can help cope with the interference injected by a jammer. If we consider a single legitimate data link and a jammer, incrementing the transmission power on the data link should increase the SINR (signal-to-interference plus noise ratio) of the received data packets. Thus, one could argue that increasing the transmission power is always beneficial in jamming environments [17]. Note here that, increasing the transmission power in environments P L (dbm) P (dbm) J Fig. 1. Percentage of the isolated throughput, for various P L and P J combinations, and for R f = R a = 4Mbps. with lower power jammers, can potentially increase the network wide interference. However, as we will see in the following, ARES includes a CCA tuning mechanism that avoids starvation effects caused from legitimate interference [1]. We vary the transmission powers of both the jammer and legitimate transceiver, as well as the CCA threshold of the latter. Note that the jammer s transmission distribution is not very relevant in this part of our study. Our expectation is that tuning the power of legitimate transceivers will provide benefits while the jammer is active. In other words, one can expect that the benefits from power control will be similar with any type of jammer. We define the following: RSSI T R : The RSSI of the signal of the legitimate transmitter at its receiver. RSSI RT : The RSSI of the signal in the reverse direction (the receiver is now the transmitter). RSSI JT and RSSI JR : The RSSI values of the jam

8 ming signal at the legitimate transmitter and receiver, respectively. RSSI J : The minimum of {RSSI JT, RSSI JR }. P L and CCA L : The transmission power and the CCA threshold at legitimate transceivers. P J : The transmission power of the jammer. Our main observations are the following: Mitigating jamming effects by incrementing P L is viable at low data rates. It is extremely difficult to overcome the jamming interference at high rates, simply with power adaptation. Increasing CCA L restores (in most cases) the isolated throughput (the throughput achieved in the absence of jammers). We present our experiments and the interpretations thereof, in what follows. 3) Increasing P L to cope with jamming interference: Increasing P L will increase the SINR and one might expect that this would reduce the impact of jamming interference on the throughput. In our experiments we quantify the gains from employing such a brute-force approach. Details on the experimental process: We perform measurements on 8 different links and with 4 jammers. We consider different fixed values for P J (from 1 dbm to 18 dbm). For each of these values we vary P L between 1 and 18 dbm and observe the throughput in the presence of the jammer, for all possible fixed transmission rates. For each chosen pair of values {P L, P J }, we run 6-minute repeated experiments and collect a new throughput measurement once every. seconds. Both end-nodes of a legitimate link use the same transmission power. The combination of high P L and low data rate helps mitigate the impact of low-power jammers. We experiment with many different locations of the jammers. Our measurements indicate that when high transmission rates are used, increasing P L does not help alleviate the impact of jammers. Our results are depicted in Figures 9 and 1. In this figure, we plot the percentage of the isolated throughput achieved in the presence of jamming, for two representative combinations of P L and P J and for 2 different rates. The isolated throughput is the throughput achieved without the presence of jammers. In our experiments on the 8 considered links, there were no links where incrementing P L increased the throughput at high data rates, even with very low jamming powers. While there could exist cases where incrementing P L could yield benefits at high rates, this was not observed. In contrast, we observe that with low data rates and when P J is low, data links can overcome jamming to a large extent by increasing P L. Figure 11 depicts another representative subset of our measurement results where all legitimate nodes use P L =18 dbm, while P J is varied between 1 and 18 dbm. We observe that the combination of high P L with low data rate helps overcome the impact of jamming, when P J is low. Note also that when P J is high, it is extremely difficult to achieve high average throughput. The above observations can be explained by taking a careful look at the following two cases: Strong jammer: Let us consider a jammer such that RSSI J > CCA L. This can result in two effects: (a) The sender will sense that the medium is constantly busy and will defer its packet transmissions for prolonged periods of time. (b) The signals of both the sender and the jammer will arrive at the receiver with RSSI values higher than CCA L. This will result in a packet collision at the receiver. In both cases, the throughput is degraded. Our measurements show that it is not possible to mitigate strong jammers simply by increasing P L. Weak jammer: Let us suppose that the jammer s signals arrive with low RSSI at legitimate nodes. This may be either due to energy-conservation strategies implemented by the jammer causing it to use low P J (e.g., 2 dbm), or due to poor channel conditions between a jammer and a legitimate transceiver. At high transmission rates, the SINR required for the successful decoding of a packet is larger than what is required at low rates (shown in Table IV) [1]. Our throughput measurements show that even in the presence of weak jammers, the SINR requirements at high transmission rates are typically not satisfied. However, since the SINR requirements at lower data rates are less stringent, the combination of high P L and low rate, provides significant throughput benefits. Data Rate SINR (db) TABLE IV SINR LEVELS REQUIRED FOR SUCCESSFUL PACKET DECODING, IN 82.11A/G. 4) Tuning CCA L on single-hop settings: Next, we investigate the potential of adjusting CCA L in conjunction with P L. Implementation and experimental details: For these experiments we exclusively use the Intel-291 cards; these cards allow us to tune the CCA threshold. We have modified a prototype version of the AP/client driver, in order to periodically collect measurements for RSSI TR, RSSI RT and RSSI J. We consider 8 AP-client data links, with traffic flowing from the AP to the client. As before, we divide the 8 data links into 2 sets of 4 isolated links. Most of these links are strong, with min[rssi TR, RSSI RT ] > 6 dbm, as depicted in the histogram in Figure 17. We use Intel s proprietary rate adaptation algorithm, which has been implemented in the firmware of the Intel-291 cards. We measure the achieved data throughput for different values of P L and CCA L. Both nodes of a data link use the same power and CCA threshold values. Tuning the CCA threshold is a potential jamming mitigation technique. To begin with, we perform throughput measurements with the default CCA L value (-8 dbm), and with various RSSI J values. We observe from Figure 12 that when RSSI J < CCA L, data links achieve high throughput. This is because signals with RSSI < CCA L are ignored by the transceiver s hardware. In particular, (a) such signals do not render the medium busy, and (b) receivers are trying to latch onto signals with RSSI > CCA L, while other signals

9 Throughput (%) P J (dbm) 6 Mbps 9 Mbps 12 Mbps 18 Mbps 24 Mbps 36 Mbps 48 Mbps 4 Mbps Fig. 11. Percentage of the isolated throughput in the presence of a balanced jammer for various P J and P J values and data rates. Fig. 12. Percentage of the isolated throughput in the presence of a balanced jammer Vs. RSSI J, for CCA L = 8 dbm. Fig. 13. Percentage of the isolated throughput, for various RSSI J values, and for CCA L = dbm. Throughput (%) P L 2dBm.2 P L 1dBm P L 1dBm P L dbm CCA(dBm) Fig. 14. Percentage of the isolated throughput, for various CCA L values and various P L values. P J = 2 dbm. Throughput (%) CCA(dBm) -4 Fig. 1. Careful CCA adaptation significantly improves the end-to-end throughput along a route. Average Throughput (Mbps) Fixed Rate Sample Rate MRC with K=3 MRC with K= Rate(Mbps) Fig. 16. MRC outperforms current rate adaptation algorithms, especially for high values of K are considered to be background noise. Moreover, even when RSSI J is slightly larger than CCA L, we still observe decent throughput achievements for the cases wherein data links operate at high SINR regimes. This is because the reported RSSI value is an average and the jammer signal could be below the threshold even here, in many cases. These measurements imply that the ability to tune CCA L can help receive data packets correctly, even while jammers are active. Fig. 17. Number of links min(rssi TR, RSSI RT ) (dbm) Histogram with RSSI TR and RSSI RT values on legitimate links. In order to further explore the potential of such an approach, we vary CCA L from -7 to -3 dbm on each of the considered 8 links. Figure 13 depicts the results for the case where CCA L is equal to - dbm.we observe that increasing CCA L results in significantly higher data throughput, even with quite high RSSI J values. More specifically, from Figure 13 we observe that when RSSI J is lower than CCA L, links can achieve up to 9% of the throughput that is achieved when the medium is jamming free. When RSSI J CCA L, data links still achieve up to 7% of the jamming-free throughput (capture of data packets is still possible to a significant extent). As one might -4 expect, if RSSI J CCA L, there are no performance benefits. Our observations also hold in some scenarios where, P J > P L. Figure 14 presents the results from one such scenario. We observe that appropriate CCA settings can allow legitimate nodes to exchange traffic effectively, even when P J P L. This is possible if the link conditions between the jammer and the legitimate transceivers are poor and result in low RSSI J. Note here that one cannot increase CCA L to arbitrarily high values on legitimate nodes. Doing so is likely to compromise connectivity between nodes or degrade the throughput due to failure of capturing packets as seen in Figure 14 for P L = dbm and P L = 1dBm. ) Tuning CCA L in multi-hop configurations: We perform experiments with various CCA thresholds along a route. Previous studies have shown that in order to avoid starvation due to asymmetric links, the transmission power and the CCA threshold need to be jointly tuned for all nodes of the same connected (sub)network [1]. In particular, the product C = P L CCA L must be the same for all nodes. Given this, we ensure that C is the same for all nodes that are part of a route. In particular, we set P L to be equal to the maximum possible value of 2 dbm on all nodes of a route; for each run, CCA L is therefore set to be the same on all of the nodes on the route. Throughout our experiments with multi-hop traffic, nodes on one route do not interfere with nodes that are on other routes. In scenarios where nodes belonging to different routes interfere with each other, if all nodes use the same P L, their CCA L values must be the same [1], [3]. However, we did not experiment with such scenarios given that our objective is to isolate the impact of a jammer and not to examine interference between coexisting sessions in a network.

10 We experiment with the same multi-hop settings as in section IV-2. Figure 1 presents the results observed on one of our routes. We observe that careful CCA tuning can provide significant average end-to-end throughput benefits along a route. VI. DESIGNING ARES In this section, we design our system ARES based on the observations from the previous section. ARES is composed of two main modules: (a) a rate module that chooses between fixed or adaptive-rate assignment, and (b) a power control module that facilitates appropriate CCA tuning on legitimate nodes. Rate Module in ARES: As discussed in section IV, our experiments with three popular rate adaptation algorithms show that the convergence time of the algorithms affects the link performance in random-jamming environments. This convergence time is largely implementation specific. As an example, our experiments with both SampleRate and Onoe show that in many cases it takes more than 1 sec for both algorithms to converge to the best rate; [31] reports similar observations. The rate module in ARES decides on whether a fixed or an adaptive-rate approach should be applied. MRC: Markovian Rate Control: MRC is an algorithm patch that can be implemented on top of any rate control algorithm. MRC is motivated by our analysis in section IV. However, as discussed earlier, it does not directly apply the analysis, since this would require extensive offline measurements (the collection of which can be time-consuming) and estimates of the jammer active and sleep periods. The key idea that drives MRC is that a rate adaptation algorithm need not examine the performance at all the transmission rates during the sleeping period of the jammer. The algorithm simply needs to remember the previously used transmission rate, and use it as soon as the jammer goes to sleep. Simply put, MRC introduces memory into the system. The system keeps track of past transmission rates and hops to the stored highest-rate state as soon as the jammer goes to sleep. Since the channel conditions may also change due to the variability in the environment, MRC invokes the re-scanning of all rates periodically, once every K consecutive sleeping/jamming cycles. When K = 1 we do not expect to have any benefits, since the scanning takes place in each cycle. Note here that the appropriate value of K depends on the environment and the sleep and active periods of the jammer. One could adaptively tune the K value. As an example, an additive increase additive decrease strategy may be used where one would increase the value of K until a degradation is seen. The K value would then be decreased. The implementation of such a strategy however, is beyond the scope of this paper. Implementation details of MRC: The implementation (a) keeps track of the highest transmission rate used over a benign time period (when the jammer is asleep) and, (b) applies this We wish to point out that state of the art routing protocols (e.g. [28]) pick routes with links of high quality. If instead, shortest path routing is used, links tend to be of poor quality and CCA tuning may not be easy to implement. rate immediately upon the detection of the next transition from the jammer s active period to the sleeping period. Figure 16 presents a set of measurements with MRC, with intermittent SampleRate invocations (once every K cycles) for K = {3, 3}. We observe that MRC outperforms pure SampleRate in jamming environments, especially with larger values of K. With small K, the rate adaptation algorithm is invoked often and this reduces the achieved benefits. Furthermore, MRC provides throughput that is close to the maximum achievable on the link (which may be either with fixed or adaptive rate, depending on whether the link is lossy or lossless). Power Control Module in ARES: As discussed in section V, increasing P L is beneficial at low rates; while at high rates this is not particularly useful, it does not hurt either. Since our goal in this paper is to propose methods for overcoming the effects of jamming (and not legitimate) interference, we impose the use of the maximum P L by all nodes in the presence of jammers. The design of a power control mechanism that in addition takes into account the imposed legitimate interference (due to high P L ) is beyond the scope of this paper. More significantly, our power control module overcomes jamming interference by adaptively tuning CCA L. The module requires the following inputs on each link: The values of RSSI TR, RSSI RT, RSSI JR, and RSSI JT. These values can be easily observed in real time. An estimation for the shadow fading variation of the channel,. Due to shadow fading, the above RSSI values can occasionally vary by. The value of is dependent on the environment of deployment. One can perform offline measurements and configure the value of in ARES. We determine the variations in RSSI measurements via experiments on a large set of links. The measurements indicate that is approximately db for our testbed (a less conservative value than what is reported in [32]). The value of CCA L has to be at least db lower than both RSSI TR and RSSI RT, to guarantee connectivity at all times. Hence, ARES sets: CCA L = min(rssi TR, RSSI RT ), max(rssi JT,RSSI JR ) min(rssi TR,RSSI RT ). Otherwise, CCA L is not changed. 6 This ensures that legitimate nodes are always connected, while the jammer s signal is ignored to the extent possible. Our experiments indicate that, especially if max(rssi JT,RSSI JR ) min(rssi TR,RSSI RT ) 2, the data link can operate as if it is jamming-free. In order to avoid starvation effects, the tuning of the CCA threshold should be performed only when nodes that participate in power control belong to the same network [3]. Unless collocated networks cooperate in jointly tuning their CCA (as per our scheme), our power control module will not be 6 We choose not to tune CCA L, unless we are certain that it can help alleviate jamming interference. if

11 Fig. 18. ARES: our Anti-jamming Reinforcement System. used. Note that when jamming attacks become more prevalent, cooperation between coexisting networks may be essential in order to fight the attackers. Hence, in such cases collocated networks can have an agreement to jointly increase the CCA thresholds when there is a jammer. Implementation details: Our power control algorithm can be applied in a centralized manner by having all legitimate nodes report the required RSSI values to a central server. The central server then applies the same CCA L value to all nodes (of the same connected network). The chosen CCA L is the highest possible CCA threshold that guarantees connectivity between legitimate nodes. This reporting requires trivial modifications on the wireless drivers. We have implemented a centralized functionality when our network is configured as a multi-hop wireless mesh. In a distributed setting, our algorithm is applicable as long as legitimate nodes are able to exchange RSSI information. Each node can then independently determine the CCA L value. To demonstrate its viability, we implement and test a distributed version of the power control module in a 82.11a/g WLAN configuration. In particular, we modify the Intel prototype AP driver, by adding an extra field in the Beacon template. This new field contains a matrix of RSSI values of neighboring jammers and legitimate nodes. We enable the decoding of received beacons in the AP driver (they do not read these by default). Assuming that a jammer imposes almost the same amount of interference on all devices (AP and clients) within a cell, the AP of the cell determines the final CCA L after a series of iterations in a manner very similar to the approaches in [3], [1]. Combining the modules to form ARES: We combine our rate and power control modules to construct ARES as shown in Figure 18. The goal of ARES is to apply the individual modules as appropriate, once the jammers are detected. For the latter, ARES relies on already existing jamming detection schemes and inherits their accuracy. For example, the mechanism that was proposed in [14] can be used; this functionality performs a consistency check between the instantaneous PDR and RSSI values. If the PDR is extremely low while the RSSI is much higher than the default CCA L, the node is considered to be jammed. We want to reiterate, that it is beyond the scope of our work to design a new, even more accurate, detection scheme. ARES applies the power control module first, since with this module, the impact of the jammer(s) could be completely overcome. If the receiver is able to capture and decode all packets in spite of the jammer s transmissions, no further actions are required. Note that even if CCA L > RSSI J, the jammer can still affect the link performance. This is because with CCA tuning the jamming signal s power is added to the noise power. Hence, even though the throughput may increase, the link may not achieve the jamming-free performance while the jammer is active. If the jammer still has an effect on the network performance after tuning CCA L, (or if CCA tuning is infeasible due to the presence of collocated uncooperative networks) ARES enables the rate module. Note that the two modules can operate independently and the system can bypass any of them in case the hardware/software does not support the specific functionality. VII. EVALUATING OUR SYSTEM We first evaluate ARES by examining its performance in three different networks: a MIMO-based WLAN, an mesh network in the presence of mobile-jammers, and an 82.11a WLAN setting where uplink TCP traffic is considered. ARES boosts the throughput of our MIMO WLAN under jamming by as much as 1%: Our objective here is twofold. First, we seek to observe and understand the behavior of MIMO networks in the presence of jamming. Second, we wish to measure the effectiveness of ARES in such settings. Towards this, we deploy a set of 7 nodes equipped with Ralink RT286 minipci cards. Experimental set-up: We examine the case for a WLAN setting, since the RT286 driver does not currently support the ad-hoc mode of operations. MIMO links with Space-Time Block Codes (STBC) are expected to provide robustness to signal variations, thereby reducing the average SINR that is required for achieving a desired bit error rate, as compared to a corresponding SISO (Single-Input Single-output) link. For our experiments, we consider 2 APs, with 2 and 3 clients each, and two jammers. Fully-saturated downlink UDP traffic flows from each AP to its clients. Applying ARES on a MIMO-based WLAN: We first run experiments without enabling ARES. Interestingly, we observe that in spite of the fact that STBC is used, 82.11n links

12 present the same vulnerabilities as 82.11a or g links. In other words, MIMO does not offer significant benefits by itself, in the presence of a jammer. This is due to the fact that 82.11n is still employing CSMA/CA and as a result the jamming signals can render the medium busy for a MIMO node as well. Moreover, for STBC codes to work effectively and provide a reduction in the SINR for a desired bit error rate (BER), the signals received on the two antenna elements will have to experience independent multipath fading effects. In other words, a line of sight or dominant path must be absent. However, in our indoor testbed, given the proximity of the communicating transceiver pair, this may not be the case. Thus, little diversity is achieved [33] and does not suffice in coping with the jamming effects. Next, we apply ARES and observe the behavior. The logical set of steps that ARES follows (in Figure 18) is Since the CCA threshold is not tunable with the RT286 cards, ARES derives decisions with regards to rate control only. Figure 19 depicts the results. We observe that the configuration with ARES outperforms the rate adaptation scheme that is implemented on the RT286 cards in the presence of the jammer, by as much as 1%. Note that higher gains would be possible, if ARES was able to invoke the power control module. In Figure 19 we also compare the throughput with MRC against the suggested settings with our analysis (these settings allow us to obtain benchmark measurements possible with global information). The parameters input to the analysis are the following: (a) The jammer is balanced with a jamming distribution U[1, ] and a sleep distribution U[1, 6]. (b) We examine four R a values: 13., 27, 4., 4 Mbps. (c) F = Mbps. (d) We input estimates of the y(r i ) values which are obtained via comprehensive offline measurements. (e) The offline measured PDR f. We observe that the performance with MRC is quite close to our benchmark measurements. These results show that in spite of having no information with regards to the jammer distribution or the convergence times of the rate adaptation algorithms, MRC is able to significantly help in the presence of a random jammer. ARES increases the link throughput by up to 1% in an 82.11a mesh deployment with mobile jammers: Next, we apply ARES in an 82.11a mesh network with mobile jammers and UDP traffic. We consider a frequent jammer (jamming distribution U[1, 2] and sleeping distribution U[, 1]). The jammer moves towards the vicinity of the legitimate nodes, remains there for k seconds, and subsequently moves away. For the mobile jammer we used a laptop, equipped with one of our Intel cards, and carried it around. The power control module is implemented in a centralized manner. ARES increases CCA L in order to overcome the effects of jamming interference, to the extent possible. In this case, due to the aggressiveness of the considered jammer (prolonged jamming duration), the rate adaptation module does not provide any benefits (since rate control helps only when the jammer is sleeping). In this scenario, ARES follows the steps: Figure 2 depicts throughput-time traces, with and without ARES, for an arbitrarily chosen link and k 2. The use of ARES tremendously increases the link throughput during the jamming period (by as much as 1 %). We have observed the same behavior with a distributed implementation of the power control module in an 82.11a WLAN setting. ARES improves the total AP throughput by up to 13% with TCP traffic: Next, we apply ARES on a 82.11a WLAN. For this experiment, we use nodes equipped with the Intel- 291 cards. We consider a setting with 1 AP and 2 clients, where clients can sense each others transmissions. We place a balanced jammer (jamming distribution U[1, ] and sleeping U[1, 8]) such that all 3 legitimate nodes can sense its presence. We enable fully-saturated uplink TCP traffic from all clients to the AP (using iperf) and we measure the total throughput at the AP, once every. sec. In this scenario, ARES follows the logical steps: From Figure 21, we observe that the total AP throughput is improved by up to 13% during the periods that the jammer is active. The benefits are less apparent when the jammer is sleeping because TCP s own congestion control algorithm is unable to fully exploit the advantages offered by the fixed rate strategy. Applying MRC on an AP improves the throughput of neighbor APs by as much as 23%: With MRC, a jammed node utilizes the lowest rate (when the jammer is active) and highest rate (when the jammer is sleeping) that provide the maximum long-term throughput. With this, the jammed node avoids examining the intermediate rates and, as we showed above, this increases the link throughput. We now examine how this rate adaptation strategy affects the performance of neighbor legitimate nodes. We perform experiments on a topology consisting of 4 APs and 8 clients, with 2 clients associated with each AP, all set to 82.11a mode. A balanced jammer with a jamming distribution U[1, ] and a sleep distribution U[1, 6] is placed such that affects only one of the APs. Only the affected AP is running MRC; the rest of the APs use SampleRate. We activate different numbers of APs at a time, and we enable fully-saturated downlink traffic from the APs to their clients. Figure 22 depicts the average total AP throughput. Interestingly, we observe that the use of MRC on jammed links improves the performance of neighbor APs that are not even affected by the jammer. This is because the jammed AP does not send any packets using intermediate bit rates (such as with the default operation of rate adaptation algorithms). Since MRC avoids the transmission of packets at lower (that the highest sustained) bit rates, the jammed AP does not occupy the medium for as prolonged periods as with the default rate control techniques; the transmission of packets at the high rate (while the jammer is asleep) takes less time. Hence, this provides more opportunities for neighbor APs to access the medium, thereby increasing the AP throughput. Specifically, we observe that the throughput of one neighbor AP is improved by 23% (when the topology consists of only 2 APs, one of which is jammed). As we further increase the number of neighbor APs, the benefits due to MRC are less pronounced, due to increased contention (Figure 22). ARES converges relatively quickly: Finally, we perform ex-

13 Average Throughput (Mbps) Benchmark Results Performance with ARES Performance without ARES Rate(Mbps) Fig. 19. ARES provides significant throughput benefits in a MIMO network in the presence of jammers. Throughput (Mbps) With ARES Without ARES Time Fig. 2. ARES provides significant throughput improvement in mobile-jamming scenarios. Throughput (Mbps) With ARES Without ARES Time Fig. 21. ARES improves the client-ap link throughput by 13% with TCP traffic scenarios. periments to assess how quickly the distributed form of ARES converges to a rate and power control setting. In a nutshell, our implementation has demonstrated that the network-wide convergence time of ARES is relatively small. With MRC, the rate control module can very rapidly make a decision with regards to the rate setting; as soon as the jammer is detected, MRC applies the appropriate stored lowest and highest rates. With regards to the convergence of the power control module, recall that our implementation involves the dissemination of the computed CCA value through the periodic transmission of beacon frames (one beacon frame per 1 msec is transmitted with our ipw22 driver) [3]. As one might expect, the jammer s signal may collide with beacon frames, and this makes it more difficult for the power control module to converge. Note also that as reported in [3], [34], beacon transmissions are not always timely, especially in conditions of high load and poor-quality links (such as in jamming scenarios). We measure the network-wide convergence time, i.e., the time elapsed from the moment that we activate the jammer until all legitimate devices have adjusted their CCA threshold as per our power control scheme. First, we perform measurements on a multi-hop mesh topology consisting of APs and 1 clients (2 clients per AP). In order to have an idea about whether the observed convergence time is significant, we also perform experiments without jammers, wherein we manually invoke the power control module through a user-level socket interface on one of the APs. We observe that the convergence time for the specific setting is approximately 1.2 sec. Then, we activate a continuously transmitting deceptive jammer in a close proximity to 2 neighbor APs (MRC is disabled; the jammer affects only the 2 APs). Table V contains various average convergence times for the specific setting and for different P J values. We observe that although the convergence time increases due to jamming, it still remains short. Furthermore, we perform extensive experiments with 8 APs, 19 clients and 4 balanced jammers with P J = 3 dbm, all uniformly deployed. We observe that in its distributed form the power control module converges in approximately 16 sec in our networkwide experiments. Although one may expect different (lower or higher) convergence times with different hardware/software and/or mobile jammers, these results show that in a static topology the power control module converges relatively quickly in practical settings. Note here that, the convergence time of the power control module appears to be larger as compared to that of the conventional rate control algorithms. However, there is a fundamental difference between the two functionalities that makes the slower convergence time of the distributed power control module less harmful. In particular, once ARES has identified the right CCA settings, it can quickly apply them in every consequent jamming cycle. On the contrary, the rate control algorithms (e.g., SampleRate) will need to start their search for the best rate in every jamming/sleeping cycle. Average AP throughput (Mbps) AP Without ARES With ARES 2 APs Number of neighbor APs 3 APs Fig. 22. MRC improves the throughput of neighbor legitimate devices, as compared to SampleRate. VIII. SCOPE OF ARES From our evaluations, it is evident that ARES can provide performance benefits in the presence of jamming, even with other wireless technologies, and both in static and dynamically changing environments. In this section, we discuss some design choices and the applicability requirements of ARES. ARES requires a driver/firmware update, but does not necessitate changes in 82.11: The two modules that constitute ARES are relatively easy to implement in the driver/firmware of commodity wireless cards, and do not require any hardware changes. The only software modification needed in the firmware involves the CCA tuning functionality. Specifically, it should be possible to change the CCA threshold as per the commands sent through a driver-firmware socket interface. To facilitate a distributed WLAN implementation of ARES, the AP driver needs to be modified to read the new Beacon template from the Beacons received from neighbor co-channel APs. Finally,

14 clients need to apply the power and CCA settings determined by their affiliated AP. Deployment of ARES, will require a driver/firmware upgrade of wireless NICs; this involves the cooperation of both vendors and users of the existing cards. Note here that devices that have not performed the ARES firmware update can still operate with those with the update; however the performance gains of our system will diminish. Finally, note that, our system does not require any changes to the standard. In particular, the standard, (i) does not specify values for the CCA, transmission power and rate and (ii) leaves space in the Beacon s template for communicating additional information required. Thus, ARES is compliant with operations. P J (db) Convergence time (sec) TABLE V AVERAGE CONVERGENCE TIMES (IN SEC) FOR DIFFERENT P J VALUES. On the effectiveness of MRC: Our analysis provided in section IV is an accurate tool that decides between the use of a fixed rate or a rate adaptation strategy. However, applying the analysis in a real system is quite challenging, for various reasons. In particular, as discussed earlier the analysis requires a set of inputs which may not be readily available. If the analysis were to be applied in real time, ARES would need to observe these values on the fly and invoke the rate module whenever significant, non-temporal changes are observed. It is also difficult to derive the jammer s distribution accurately and quickly. Such requirements make the application of the analysis somewhat infeasible in real-time systems. Furthermore, the analysis can account for the presence of one jammer only. In scenarios with multiple jammers, it cannot decide between fixed or adaptive rate. In contrast, our more practical scheme MRC does not need any inputs. It can operate efficiently even with multiple jammers. Note that MRC in its current form takes into account the time 7 that has elapsed since the last time that rate control was invoked. The policy is to invoke the rate adaptation strategy after periodic intervals. The optimal rate at which rate adaptation should be invoked depends on the temporal variability of the channel. In particular, to perform this optimally, ARES would need to measure (or estimate) the coherence time τ of the channel (time for which the channel remains unchanged [3]) and invoke the rate control algorithm every τ secs. While this is not possible with current hardware, it may be possible in the future [3]. Alternatively ARES could employ a learning strategy as discussed in Section VI. ARES with reactive and constant jammers: For the most part in this work we considered various types of random jammers. With constant jammers, rate adaptation is not expected 7 In its current form, this time is in terms of the number of jamming cycles; this can be easily modified to use more generic time units. to provide benefits, since the continuous jamming interference does not allow the use of high rates. Nevertheless, rate control (even as a standalone module) is expected to provide benefits in the presence of reactive jamming. In particular, let us consider a link consisting of legitimate nodes A and B. The reactive jammer J needs to sense the ongoing transmission and quickly transmit its jamming signal. If we denote by t flight, the flight time of the legitimate packet and with t sense the time needed for J to sense this packet, then the probability of successful packet corruption 8 can be calculated as: P jam = P(t sense < t flight ). Assuming that t sensing is uniformly distributed at the interval [, DIFS] 9 we get: P jam = t flight 1 DIFS dt = t flight DIFS = #bytes/packet rate DIFS From Eq. 2 it is clear that through the use of high bit rates and/or reduced packet sizes the probability of successful reactive jamming can be decreased. However, there is a tradeoff between successful reception and decreased jamming probability that needs to be examined more carefully. Finally, the power control module of ARES, can be useful in the presence of both constant (as shown in the previous section) and reactive jamming. Rate control algorithms dealing with hidden terminals cannot mitigate jamming attacks: There are a few rate control algorithms that try to deal with hidden terminal nodes in WLANs. Their key feature is distinguishing between packet errors due to (i) channel effects and (ii) collisions. As an example Kim et al [36] propose CARA (Collision-Aware Rate Adaptation), which makes use of the RTS/CTS exchange to differentiate between a channel error and a collision. In brief, a packet loss after a successful RTS/CTS exchange will be most probably due to channel errors. However, even if the operations of a jammer cause effects that resemble those due to hidden terminals 1, CARA is not particular useful. The reason is that the jammer does not follow the rules specified by the standard. As a result even if it listens the RTS/CTS exchange (which can be successful even under jamming due to their short durations), it will not backoff and thus, there will still be a packet collision. CARA will assume that this is due to channel errors and a less aggressive modulation scheme will be used, reducing the transmission rate. Similar techniques are employed by RRAA [21], and thus even this scheme cannot efficiently cope with jamming attacks. In addition, RRAA is implemented using specialized, programmable hardware platforms with capabilities that most of the commodity APs do not have. Limitations of ARES: ARES s design principles are based on the operations of the protocol. Thus, its applicability 8 We assume an optimal reactive jammer, i.e., one which is able to jam at the exact time instance when it senses a legitimate packet (best case scenario for the adversary). In reality, this will not be the case. 9 This is a reasonable assumption to make since the protocol allows for a DIFS period in order to sense any transmission. 1 Both ignore ongoing transmissions; the jammer because it simply wants to, while the hidden terminal because it cannot listen to them (2)

15 is limited to this class of networks. Extending our system to broadly support any wireless network is not straightforward. However, our goal in this work is the design of a jamming countermeasure for In addition, we acknowledge that, ARES utilizes functionalities that are currently unavailable in commercial NICs. In particular, CCA tuning (and in general the carrier sensing functionality of the protocol) is implemented in the firmware of the cards, which is generally closed source. Therefore, its adoption is limited to systems that provide access to these operations. However, we expect that given its benefits (and the emergence of software defined radios) this functionality will be made available as a tunable feature. IX. CONCLUSIONS We design, implement and evaluate ARES, an anti-jamming system for networks. ARES has been built based on observations from extensive measurements on an indoor testbed in the presence of random jammers, and is primarily composed of two modules. The power control module tunes the CCA thresholds in order to allow the transmission and capture of legitimate packets in the presence of the jammer s signals, to the extent possible. The rate control module decides between fixed or adaptive-rate assignment. We demonstrate the effectiveness of ARES in three different deployments (a) a 82.11n based MIMO WLAN, (b) an 82.11a network infested with mobile jammers, and (c) a 82.11a WLAN with uplink TCP traffic. ARES can be used in conjunction with other jamming mitigation techniques (such as frequency hopping or directional antennas). Overall, the application of ARES leads to significant performance benefits in jamming environments. Acknowledgments: We thank Ralink Corp. for providing the source of the RT286 AP driver, and Dr. Konstantina Papagiannaki from Intel Research for providing the prototype version of the ipw22 driver. REFERENCES [1] SESP jammers. [2] Jamming attack at hacker conference. mein/ is 2 August 2/ai n [3] Techworld news. news/index.cfm?newsid=1941. [4] RF Jamming Attack. products/wifimanager/rfjamming-attack.html. [] V. Navda, A. Bohra, S. Ganguly, and D. Rubenstein. Using Channel Hopping to Increase Resilience to Jamming Attacks. In IEEE INFOCOM mini-conference, 27. [6] W. Hu, T. Wood, W. Trappe, and Y. Zhang. Channel Surfing and Spatial Retreats: Defenses Against Wireless Denial of Service. In ACM Workshop on Wireless Security, 24. [7] ISM Wide-band Jammers. [8] ISA: Users fear wireless networks for control. [9] K. Pelechrinis, C. Koufogiannakis, and S.V. Krishnamurthy. Gaming the Jammer: Is Frequency Hopping Effective? In WiOpt, June 29. [1] V. Mhatre, K. Papagiannaki, and F. Baccelli. Interference Mitigation through Power Control in High Density WLANs. In IEEE INFOCOM, 27. [11] J. Bicket. Bit-rate Selection in Wireless Networks. In MS Thesis, Dept. of Electr. Engin. and Comp. Science, MIT, 2. [12] Onoe Rate Control. rate/onoe. [13] S. Pal, S. R. Kundu, K. Basu, and S. K. Das. IEEE Rate Control Algorithms: Experimentation and Performance Evaluation in Infrastructure Mode. In PAM, 26. [14] W. Xu, W. Trappe, Y. Zhang, and T. Wood. The Feasibility of Launching and Detecting Jamming Attacks in Wireless Networks. In ACM MOBI- HOC, 2. [1] R. Gummadi, D. Wetheral, B. Greenstein, and S. Seshan. Understanding and Mitigating the Impact of RF Interference on Networks. In ACM SIGCOMM, 27. [16] W. Hu, K. Ma, W. Trappe, and Y. Zhang. Jamming Sensor Networks: Attacks and Defense Strategies. In IEEE Network, May/June 26. [17] G. Lin and G. Noubir. On Link Layer Denial of Service in Data Wireless LANs. In Wireless Communications and Mobile Computing, May 23. [18] G. Noubir and G. Lin. Low-power DoS Attacks in Data Wireless LANs and Countermeasures. In ACM MOBIHOC (poster), 23. [19] G. Noubir. On Connectivity in Ad Hoc Network under Jamming Using Directional Antennas and Mobility. In Wired/Wireless Internet Communications, Vol. 297/24, pp , 24. [2] K. Pelechrinis, M. Iliofotou, and S. V. Krishnamurthy. Denial of Service Attacks in Wireless Networks: The case of Jammers. In IEEE Communication Surveys and Tutorials, 2 nd quarter, 211. [21] S.Wong, H.Yang, S.Lu, and V.Bharghavan. Robust Rate Adaptation in Wireless Networks. In MOBICOM, 26. [22] V.Shah and S.V.Krisnamurthy. Handling Assymetry in Power Heterogeneous Ad hoc Networks: A Cross Layer Approach. In IEEE ICDCS, 2. [23] H. Zhai and Y. Fang. Physical Carrier Sensing and Spatial Reuse in Multirate and Multihop Wireless Ad Hoc Networks. In IEEE INFOCOM, 26. [24] I. Broustis, J. Eriksson, S. V. Krishnamurthy, and M. Faloutsos. A Blueprint for a Manageable and Affordable Wireless Testbed: Design, Pitfalls and Lessons Learned. In IEEE TRIDENTCOM, 27. [2] UCR Wireless testbed. [26] The MadWiFi driver. [27] RT286 wireless driver. /Support/Linux.html. [28] D. S. J. De Couto, D. Aguayo, J. Bicket, and R. Morris. A High Throughput Path Metric for MultiHop Wireless Routing. In ACM MOBICOM, 23. [29] J. C. Chen and J. M. Gilbert. Measured Performance of -GHz 82.11a Wireless LAN Systems. In Atheros Comm. White Paper, August 21. [3] I. Broustis, K. Papagiannaki, S. V. Krishnamurthy, M. Faloutsos, and V. Mhatre. MDG: Measurement-Driven Guidelines for WLAN Design. In ACM MOBICOM, 27. [31] SampleRate Bug. [32] S. Zvanovec, P. Pechac, and M. Klepal. Wireless LAN Networks Design: Site Survey or Propagation Models? In Radioengineering, Vol. 12, No. 4, Dec. 23. [33] H.Jafarkhani. Space-Time Coding: Theory and Practice. Cambridge University Press, 2. [34] S. Vasudevan et al. Facilitating Access Point Selection in IEEE Wireless Networks. In ACM IMC, 2. [3] J. Camp and E. W. Knightly. Modulation Rate Adaptation in Urban and Vehicular Environments: Cross-Layer Implementation and Experimental Evaluation. In ACM MOBICOM, 28. [36] J. Kim, S. Kim, S. Choi, and D. Qiao. CARA: Collision-Aware Rate Adaptation for IEEE WLANs. In IEEE INFOCOM, 26.

16 Konstantinos Pelechrinis Konstantinos Pelechrinis received his PhD from the Computer Science department of University of California, Riverside, in 21. Previously he obtained his MSc degree from the Computer Science department of University of California, Riverside in 28 and the diploma of Electrical and Computer Engineering from the National Technical University of Athens, Greece, in 26. He is an Assistant Professor at the SIS faculty of the University of Pittsburgh since Fall 21. He has also held research positions at LANL, Thomson Research Labs Paris and MSR Cambridge. He was a visiting researcher at the University of Thessaly during Fall 28. His research interests include wireless networking, especially security - related issues that span the full protocol stack. He is involved in protocol design, real world experimentation and performance analysis. He is also interested in mathematical foundations of communication networks. Ioannis Broustis Ioannis Broustis received the M.Sc. and Ph.D. degrees in computer science and engineering from the University of California, Riverside, and the Diploma in electronics and computer engineering from the Technical University of Crete, Greece. He is with Alcatel-Lucent, USA, since January 21. During 29 he was a Researcher with the University of California, Riverside. During 28, he was a Researcher with the Center for Research and Technology Hellas, Thessaloniki, Greece, as well as an Adjunct Assistant Professor with the University of Thessaly, Volos, Greece. During 26, he was an intern with Intel Research in Cambridge, U.K., while during 2, he was an intern with Nokia R&D, Boston, MA. His research interests include cross-layer network protocol design, development, and testbed experimentation for wireless networks. Srikanth V. Krishnamurthy Srikanth V. Krishnamurthy received his Ph.D degree in electrical and computer engineering from the University of California at San Diego in From 1998 to 2, he was a Research Staff Scientist at the Information Sciences Laboratory, HRL Laboratories, LLC, Malibu, CA. Currently, he is a professor of Computer Science at the University of California, Riverside. His research interests are primarily in wireless networks and security. Dr. Krishnamurthy is the recipient of the NSF CAREER Award from ANI in 23. He was the editor-in-chief for ACM MC2R from 27 to 29. He is a senior member of the IEEE. Christos Gkantsidis Christos is a researcher in the Systems and Networking Group in Microsoft Research, Cambridge, UK. He holds a Ph.D. from Georgia Institute of Technology, Atlanta, GA, USA, and a bachelors from University of Patras, Greece, both in computer science. He is interested in content distribution networks, peer-to-peer technologies, analysis and modelling of complex communication networks, and wireless mesh networking. Christos is a member of IEEE and ACM.